SOURCE_URL: https://majikah.solutions/products/majik-message/docs/file-vault

---
title: "File Vault — Offline File Encryption"
id: "file-vault"
group: "majik-message"
type: "products"
version: "1.1.0"
lastUpdated: "2026-03-11T00:00:00.000Z"
difficulty: "Beginner"
time: "5-10 minutes"
tags: [encryption, decryption, offline, local, file, file-vault, privacy, security, post-quantum, ml-kem, aes-gcm, mjkb, compression, zstd, yara, magika, file-scanning, threat-detection, pre-encrypt-scan, post-decrypt-scan]
---

# File Vault — Offline File Encryption

> Learn how to encrypt and decrypt any file locally using post-quantum encryption, with built-in YARA threat scanning and Magika content-type detection in the Majik Message File Vault.

## Overview
Encrypt and decrypt any file locally with Majik Message's File Vault using post-quantum ML-KEM-768 (FIPS-203) combined with AES-256-GCM and Zstd compression. Every file is automatically scanned for threats before encryption and after decryption using an embedded YARA engine and Google's Magika content-type detector — all running entirely in your browser with no data sent to any server. Drop any file in — images, video, audio, documents, code, archives, executables, 3D assets, and 130+ other formats — and it gets sealed into a portable .mjkb binary you can store, share, or upload anywhere. Only the authorized account(s) you specify can ever decrypt it.

### What is the File Vault?

The File Vault is a fully offline, post-quantum file encryption tool built into Majik Message. It works the same way as Majik Message's message encryption — using ML-KEM-768 (FIPS-203) for key encapsulation and AES-256-GCM for symmetric encryption — but instead of encrypting text strings, it encrypts any file format you throw at it. Files are automatically compressed with Zstd before encryption to reduce binary size, then sealed into Majikah's proprietary .mjkb binary format. New in this version: every file is scanned for threats by an embedded YARA engine and Google's Magika content-type detector before it can be encrypted, and again after decryption — entirely in your browser, without any data leaving your device.

> **NOTE:** Access File Vault from the 6th tab in the top navigation bar.

### Account Required

> ⚠️ **WARNING:** You must have at least one seed phrase account created or imported and set as active before you can encrypt or decrypt any file. If you don't have an account yet, go to the Accounts tab first.

### Interface Layout

The File Vault is split into two side-by-side panels. The left panel is the input — this is where you drop or browse for the file you want to process, and where you choose the Zstd compression preset. The right panel is the output — this is where you monitor encryption or decryption progress, review the scan result, and download your result. At the top of the right panel is a mode toggle: Encrypt (blue) or Decrypt (green). Above the panels is the Recipients section, where you specify who should be able to decrypt the file. A persistent scan bar sits at the bottom of the output panel and surfaces the security verdict for every file processed.

### Built-in Threat Scanning

The File Vault includes a two-layer threat scanner that runs locally in your browser on every file — no data ever leaves your device. The scanner combines YARA pattern matching (a battle-tested security rule engine used by malware analysts worldwide) with Google's Magika (a deep-learning content-type detector) to catch both known threat signatures and deceptive file types. Scanning runs automatically: once before encrypting a file, and again on the recovered plaintext after decrypting a .mjkb. The result is surfaced in the scan bar below the output panel and in the result card.

### Scan Score and Risk Bands

Every scan produces a cleanliness score from 0 to 100. The score starts at 100 and deductions are applied for each matched YARA rule, weighted by severity. Files with no matches score 100. The score maps to five qualitative risk bands: Clean (90–100), Low Risk (70–89), Moderate Risk (40–69), High Risk (1–39), and Critical Risk (0). Files scoring 70 or below are blocked from uploading to cloud storage. In the File Vault's local encrypt/decrypt workflow, a threat detection triggers a warning but the download button remains available after acknowledgement — giving you full control over your own files.

### Risk Band Reference

| Score | Risk Band | Meaning |
| --- | --- | --- |
| 90–100 | Clean | No threats detected — all rules passed |
| 70–89 | Low Risk | Weak or informational signals only — safe to proceed |
| 40–69 | Moderate Risk | Suspicious patterns — proceed with caution |
| 1–39 | High Risk | Strong threat signals — review before use |
| 0 | Critical Risk | Catastrophic match — hard block in upload contexts |

*Caption: How scan scores map to risk bands and UI behavior*

### Severity Tiers

Each matched YARA rule carries a severity tier that determines how many points are deducted from the score. Danger rules (−100 pts) trigger an immediate hard block — they indicate file type spoofing or catastrophic threats with no override. Critical rules (−40 pts) flag strong threat signals such as detected PE/ELF executables, PHP webshells, or Office DDE injection. High rules (−20 pts) cover dropper patterns, embedded binaries, JNDI injection, and credential material like SSH private keys. Medium rules (−10 pts) surface context-dependent signals such as base64 loaders, Office auto-exec strings, and shebang scripts. Low rules (−5 pts) flag weak signals like obfuscated JavaScript or CSV formula injection. Info rules (0 pts) are purely informational — for example, detecting a ZIP header or an EICAR test string.

### Content-Type Detection with Magika

Google's Magika deep-learning model analyses the actual bytes of your file to determine what it really is — independent of the filename or extension. This powers four detection paths. File Type Spoof (Danger): if a file has a non-executable extension but Magika detects executable content with high confidence (>80%) and the declared extension scores near zero, the file is flagged as a dangerous spoof — for example, a file named document.pdf that is actually a Windows PE executable. This is a hard block with no override. Declared Executable (High, soft-warn): if a file openly uses an executable extension (.exe, .dll, .elf, etc.) and Magika confirms executable content, it is classified as a declared executable. The scan deducts 20 points but does not hard-block — a warning dialog is shown. Undeclared Executable (Critical): executable content detected at >60% confidence but the extension is not in the declared executable list — for example, a .docx that Magika identifies as an ELF binary. Clean Type (Info): not executable — purely informational, no score impact.

> **NOTE:** Windows .lnk shortcut files are always classified as Critical regardless of extension transparency. They are frequently used as phishing delivery vectors and are never treated as safely declared executables.

### The Scan Bar

The scan bar is a persistent strip at the bottom of the output panel that updates in real time as each scan runs. While scanning, it pulses amber and shows Scanning…. Once complete, it displays the risk band label, score, and a one-line summary of the top finding. Click ▼ Details to expand the panel and see the full breakdown: score, risk band, duration, and every matched YARA rule grouped by severity with its description and point deduction. The Scan Phase Badge in the output panel header also reflects the current state — Scanning…, Scan clean, Threat detected, or Scan inconclusive.

### Double-Encrypt Guard

After decrypting a .mjkb file, the File Vault checks whether the recovered plaintext is itself a valid .mjkb binary. If so, a warning banner appears in the output panel: Nested .mjkb detected. This means the file was double-encrypted — someone encrypted an already-encrypted .mjkb. The result card will show ⚠ Nested .mjkb — decrypt again. Download the file and run it through Decrypt mode a second time to recover the original plaintext. By design, the File Vault blocks encrypting an already-encrypted .mjkb at the input stage to prevent accidental double-encryption.

### Compression Presets

In Encrypt mode, once a valid file is loaded you can choose a Zstd compression preset from a pill selector in the left panel. Seven presets are available: Fastest (lv 2), Fast (lv 3), Balanced (lv 6), Good (lv 9 — default), Better (lv 15), Best (lv 19), and Ultra (lv 22). Higher levels compress more aggressively but take longer and use more memory. For most files, Good offers the best balance of speed and size reduction. Ultra is suited for archival use and is automatically clamped to a lower level for large files to prevent out-of-memory errors in the WASM runtime.

### Compression Preset Reference

| Preset | Zstd Level | Best For |
| --- | --- | --- |
| Fastest | 2 | Speed-first — large files where CPU time matters |
| Fast | 3 | Zstd default fast mode — general use |
| Balanced | 6 | Best ratio-per-ms — recommended for most uploads |
| Good | 9 | Default — strong compression, reasonable time (recommended) |
| Better | 15 | High-effort — documents and code archives |
| Best | 19 | Near-maximum — WASM-safe ceiling for large files |
| Ultra | 22 | Archival — auto-clamped on files >10 MB to prevent OOM |

*Caption: Available Zstd compression presets and when to use them*

> **NOTE:** If your chosen preset would exceed the safe level for the file's size, a ⚡ Clamp Notice appears below the preset picker showing the effective level that will actually be used. The preset is auto-clamped to: lv 19 for files >10 MB, lv 16 for files >50 MB, lv 12 for files >100 MB, lv 6 for files >500 MB.

> **NOTE:** Zstd compression is applied automatically for compressible formats (text, PNG, BMP, PDF, JSON, WAV, FLAC, etc.). Already-compressed formats like JPEG, WebP, MP4, ZIP, and RAR skip compression since they gain no benefit. The effective Zstd level used is embedded in the .mjkb context field and recovered automatically at decryption time — you do not need to remember which level you used.

### How File Encryption Works

When you encrypt a file, Majik Message performs the following pipeline entirely on your device: (1) Scan — the file is scanned by the YARA engine and Magika. If the scan score is below the block threshold or a danger-tier rule matches, encryption is halted. (2) Hash — a SHA-256 digest of the original raw bytes is computed for integrity and deduplication. (3) Compress — the file is Zstd-compressed at the chosen preset level (skipped for already-compressed formats). (4) ML-KEM-768 encapsulate — for each recipient a post-quantum key encapsulation produces a unique shared secret; for multiple recipients a random 32-byte AES key encrypts the file once and each recipient's shared secret wraps that key via XOR. (5) AES-256-GCM encrypt — the compressed bytes are encrypted with a 12-byte random IV. The result is encoded into a .mjkb binary containing the IV, payload JSON (with ML-KEM ciphertext and embedded metadata), and the ciphertext.

### The .mjkb Binary Format

All encrypted files are stored in Majikah's proprietary .mjkb format — a compact binary envelope designed for consistent parsing across the web app, Electron desktop app, and Chrome Extension. The binary layout is: [4 bytes magic "MJKB"] [1 byte version] [12 bytes AES-GCM IV] [4 bytes payload JSON length] [N bytes payload JSON] [M bytes AES-GCM ciphertext]. The payload JSON embeds the ML-KEM ciphertext(s), the original filename, MIME type, file context, and the compression level used — so metadata is recovered automatically at decryption time without needing a separate database lookup.

### Recipients — Who Can Decrypt?

Before encrypting, choose who should be able to decrypt the file using the Recipients selector above the panels. Your active account is always included by default — this ensures you can always decrypt your own files. If you want to share a file with specific people, add them as recipients from your contact directory. Each recipient gets their own ML-KEM-768 key slot in the .mjkb envelope, meaning they can independently decrypt the file without exposing each other's key material. Encrypted files can only ever be decrypted by the exact account(s) used at encryption time — no exceptions.

> **NOTE:** Recipients must already be in your contact directory. To add a new contact, click the Add Contact button in the header and enter their invite key.

### Encrypt a File

1. **Open File Vault**
   *Navigate to the correct tab*
   - Go to the 6th tab in the top navigation bar — labeled File Vault
   - The interface loads in Encrypt mode by default (blue toggle)

2. **Set Recipients**
   *Who should be able to decrypt this file?*
   - Check the Recipients section above the panels
   - Your active account is pre-selected — this means only you can decrypt the file
   - To allow others to decrypt it too, add them from your contact directory
   - Each added recipient gets their own independent ML-KEM key slot in the .mjkb envelope

3. **Provide Your Input File**
   *Drop or browse for the file you want to encrypt*
   - In the left panel, drag and drop a file directly onto the drop zone, or click to browse
   - 130+ file formats are supported — images, video, audio, documents, code, archives, executables, 3D, design files, and more
   - Once loaded, the panel shows the filename, size, and MIME type along with a green Allowed chip
   - .mjkb files are rejected — if you accidentally drop one, the vault auto-switches to Decrypt mode

4. **Choose a Compression Preset**
   *Select how aggressively to compress before encrypting*
   - The Compression pill selector appears in the left panel once a valid file is loaded
   - The default preset is Good (Zstd lv 9) — suitable for most files
   - Choose a higher preset for better compression at the cost of more CPU time, or a lower preset for speed
   - If the selected preset would be auto-clamped for your file size, a ⚡ Clamp Notice appears showing the effective level

5. **Scan and Encrypt**
   *Trigger the encryption pipeline*
   - Click the Encrypt button in the bottom-right footer of the right panel
   - The output panel first shows Scanning… while YARA and Magika analyse the file
   - If a threat is detected with a score ≤ 70, encryption is blocked and a toast error is shown — the file cannot be encrypted until it is removed
   - If the scan passes, the pipeline continues: Hash → Compress → ML-KEM encapsulate → AES-GCM encrypt
   - The scan result is preserved in the output panel and scan bar even after encryption completes

6. **Review & Download**
   *Inspect the result and save your .mjkb file*
   - The right panel shows: output filename, cipher, original size, encrypted size, compression level used, SHA-256 hash, and the pre-encrypt scan verdict
   - The scan bar at the bottom of the output panel shows the risk band and score — click ▼ Details to expand the full findings breakdown
   - Click Download .mjkb to save the encrypted binary to your device
   - The downloaded file is named [original-name]_[hash-prefix].mjkb


### Decrypt a File

1. **Switch to Decrypt Mode**
   *Toggle the mode switcher*
   - Click the Decrypt pill in the mode toggle (top-right of the panels) — it turns green
   - The left panel now only accepts valid .mjkb files

2. **Provide Your .mjkb File**
   *Drop or browse for the encrypted binary*
   - Drag and drop a .mjkb file onto the left panel drop zone, or click to browse
   - The panel validates the file by checking both magic bytes (MJKB) and structural integrity via MajikFile.isValidMJKB()
   - If you drop a non-.mjkb file, the vault auto-switches to Encrypt mode

3. **Decrypt the File**
   *Trigger the decryption pipeline*
   - Click the Decrypt button in the footer of the right panel
   - The output panel progresses through: Parse .mjkb → ML-KEM decapsulate → AES-GCM decrypt → Decompress
   - Decryption happens entirely on your device — no data is sent to any server
   - If your active account was not one of the authorized recipients, decryption will fail immediately

4. **Post-Decrypt Scan**
   *The recovered plaintext is automatically scanned*
   - After decryption, the recovered file is immediately scanned with YARA and Magika
   - The scan bar updates to show the post-decrypt security verdict
   - If a threat is detected, a toast warning is shown — but you can still download the file after acknowledging the warning
   - If the decrypted payload is itself a valid .mjkb binary, a Nested .mjkb detected warning banner appears

5. **Review & Download**
   *Recover and save the original file*
   - The right panel shows: recovered filename, MIME type, original size, a ML-KEM verification badge, decompression status, and the post-decrypt scan verdict
   - If the scan flagged a threat, the download button turns red — ⚠ Download Anyway — as a visual reminder
   - Click Download File to save the restored file — it is identical to the original before encryption


### Decryption Requires Authorization

> ⚠️ **WARNING:** You can only decrypt a .mjkb file if your currently active account was explicitly included as a recipient when the file was encrypted. Possessing the .mjkb binary alone is not enough — your ML-KEM-768 key must match one of the key slots embedded in the binary. If it does not, decryption will fail immediately. There is no override or password recovery.

### Supported File Formats

File Vault supports 130+ file formats across every major category. Images: PNG, JPEG, GIF, WebP, AVIF, SVG, BMP, TIFF, ICO, HEIC, HEIF, JXL, PSD, XCF, RAW (CR2, NEF, ARW). Video: MP4, WebM, MOV, AVI, MKV, FLV, 3GP, MPEG, WMV, M4V. Audio: MP3, OGG, WAV, AAC, FLAC, M4A, MIDI, AIFF, Opus, AMR. Documents: PDF, DOCX, DOC, XLSX, XLS, PPTX, PPT, ODT, ODS, ODP, RTF. Text & Code: TXT, HTML, CSS, CSV, JSON, XML, Markdown, JavaScript, TypeScript, Python, Java, C, C++, C#, Go, Rust, Swift, Kotlin, Ruby, PHP, Shell, PowerShell, Lua, SQL, GraphQL, YAML, TOML. Archives: ZIP, RAR, 7Z, TAR, GZ, BZ2, XZ, ZST. Executables & Installers: EXE, MSI, DMG, DEB, RPM. Fonts: TTF, OTF, WOFF, WOFF2. 3D & Design: GLB, GLTF, OBJ, STL, Blender, FBX, Figma, Sketch, XD, Affinity. Database: SQLite. eBook: EPUB, MOBI. Certificates: PEM, P12, CER.

> **NOTE:** Executable file types (EXE, DMG, DEB, RPM, etc.) are accepted by the File Vault and will be processed through the Declared Executable path in the scanner — the scan deducts 20 points but does not hard-block. A warning is shown in the scan bar. This lets you legitimately encrypt and share installers or binaries while still surfacing the risk.

### Quick Reference

| Task | Panel | Mode | Notes |
| --- | --- | --- | --- |
| Encrypt a file | Left (input) + Right (output) | Encrypt (blue) | Scan runs automatically before encryption |
| Choose compression preset | Left panel — Compression section | Encrypt | Default: Good (lv 9) |
| Set recipients | Recipients section (above panels) | Encrypt | Contacts in directory |
| Download .mjkb | Right panel footer | Encrypt | Encryption and scan must both complete |
| Decrypt a .mjkb file | Left (input) + Right (output) | Decrypt (green) | Active account must be a recipient |
| Post-decrypt scan | Right panel — scan bar | Decrypt | Runs automatically on recovered plaintext |
| View scan details | Right panel — scan bar → ▼ Details | Either | Shows all matched rules, severity, and deductions |
| Download recovered file | Right panel footer | Decrypt | Button turns red if scan flagged a threat |
| Handle nested .mjkb | Right panel — warning banner | Decrypt | Download and decrypt again to unwrap |
| View cloud-stored files | Header → My Files button | Either | Requires authenticated account |

*Caption: Common File Vault tasks and where to find them*

### Privacy & Security Guarantees

All encryption, decryption, and threat scanning happen entirely on your device. Your files, private keys, plaintext, and scan results never leave your computer. The YARA engine (via libyara-wasm) and Magika model both run as in-browser WASM and JavaScript modules respectively — no network calls are made during scanning. The .mjkb output is safe to store anywhere because the cryptographic envelope is self-contained and only breakable by the authorized recipients' ML-KEM-768 secret keys. The combination of ML-KEM-768 (NIST FIPS-203) and AES-256-GCM ensures your files remain secure against both today's attacks and future quantum computers.

> **NOTE:** File Vault works completely offline. No internet connection is required for local encryption, decryption, or threat scanning. Your files, keys, and scan results never leave your device.

### Cloud File Storage (Covered in Separate Guide)

In addition to local offline encryption, Majik Message includes an online My Files vault accessible via the My Files button in the File Vault header. Cloud uploads require a YARA scan pass (minimum score 70) before any file can be uploaded. Because the cloud storage and sharing features are extensive, they are covered in their own dedicated documentation. Everything described on this page works entirely offline.